Attackers increasingly log in rather than break in. Stolen passwords, phished sessions and forgotten admin accounts are behind a large share of serious incidents. This checklist covers the identity controls that make the biggest difference for organisations using Active Directory, Microsoft Entra ID (formerly Azure AD) and cloud platforms.
1. Multi-factor authentication everywhere
- Require MFA for every user, with no permanent exceptions.
- Use phishing-resistant methods, such as passkeys, FIDO2 security keys or Windows Hello for Business, for administrators first.
- Turn on number matching and additional context for push notifications to reduce MFA fatigue attacks.
- Block legacy authentication protocols that cannot do MFA.
2. Control privileged access
- Keep the number of Domain Admins and Global Administrators as small as possible.
- Give administrators separate admin accounts that are never used for email or browsing.
- Use just-in-time elevation, such as Privileged Identity Management, instead of permanent admin rights.
- Keep two well-protected emergency (break-glass) accounts and monitor every use.
3. Clean up Active Directory
- Disable and remove accounts that have not signed in for a defined period.
- Review service accounts: use long, random passwords or managed service accounts, and remove unneeded privileges.
- Find and fix attack paths to Domain Admin using tools such as BloodHound.
- Retire legacy protocols such as NTLMv1 and enforce LDAP signing.
- Use the Local Administrator Password Solution (LAPS) so every device has a unique local admin password.
4. Harden Microsoft Entra ID
- Use Conditional Access policies to require MFA, compliant devices and trusted locations for sensitive access.
- Review guest users and remove those no longer needed.
- Restrict who can register applications and grant consent to third-party apps.
- Enable sign-in and audit logs, and keep them long enough to investigate incidents.
5. Manage the identity lifecycle
- Automate joiner, mover and leaver processes from your HR system where possible.
- Remove access promptly when people leave, including access to SaaS applications.
- Run periodic access reviews, so managers confirm their team’s access is still needed.
6. Single sign-on for business applications
- Connect business applications to single sign-on so access is controlled centrally.
- Disable local logins on applications that support SSO.
- Keep an inventory of applications and who owns each one.
7. Watch for identity attacks
- Alert on risky sign-ins, impossible travel and new admin role assignments.
- Monitor password spraying and repeated MFA prompts.
- Make sure endpoint detection and response covers domain controllers and servers.
Where to start
If you can only do three things this month: enforce MFA for every account, remove unused admin rights, and block legacy authentication. Then work through the rest of this list in order of risk.
Cenvox provides identity and access management (IAM) security assessments and hardening for Active Directory, Entra ID and cloud platforms. Talk to us about a review.